high · CVSS v3 7.7

CVE-2026-119433

Foxit Workspace contains an undocumented API endpoint that allows server‑side request forgery (SSRF). An attacker can force the server to re

Overview

Foxit Workspace contains an undocumented API endpoint that allows server‑side request forgery (SSRF). An attacker can force the server to request arbitrary internal or external URLs, exposing sensitive data or internal services. This flaw can be leveraged for reconnaissance and unauthorized access.

Description

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.

Impact

The vulnerability compromises confidentiality by exposing internal resources, can affect integrity if internal services are accessed or modified, and may impact availability if the server is overloaded with forged requests. System administrators and security teams are directly impacted as they must mitigate potential data leaks and unauthorized access.

Remediation

Apply the latest Foxit Workspace patch or upgrade to the most recent release. Disable or restrict the undocumented API endpoint if possible. Implement strict outbound firewall rules to limit the server’s ability to reach internal networks, and validate or whitelist URLs before forwarding requests.

Risk context

The CVSS v3 score of 7.7 indicates a high severity risk. While EPSS data is not available, the high severity suggests a timely response is advisable.

Affected products

  • Foxit Workspace

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.7
CVSS v4
—
EPSS
—

SSRF Foxit Workspace API InternalRecon HighSeverity Patch NetworkSecurity

← All CVEs

Related CVEs

high

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that a published page or post on the target site contains the [meta_data_filter_results] shortcode, which is the primary output feature of the plugin.

View analysis

high

CVE-2026-123280

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

View analysis

high

CVE-2025-71458

FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.

View analysis

high

CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.

View analysis